fix: harden deploys and close top security holes after /events outage

Isolate next dev from production .next, add build-guard/atomic deploy/health
watchdog, error boundaries, and fix JWT startup, meetup leaks, media path
traversal, SVG/memory uploads, and JSON-LD escaping.

Co-authored-by: Cursor <cursoragent@cursor.com>

ops/install-systemd.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# Install the production hardening units (build guard + health watchdog).
+# Requires sudo. Safe to re-run (idempotent).
+#
+#   sudo ops/install-systemd.sh
+
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if [ "$(id -u)" -ne 0 ]; then
+  echo "install-systemd: re-run as root, e.g.:" >&2
+  echo "  sudo $0" >&2
+  exit 1
+fi
+
+mkdir -p /etc/systemd/system/bbe-frontend.service.d
+cp "${REPO_DIR}/ops/systemd/bbe-frontend.service.d/verify-build.conf" \
+   /etc/systemd/system/bbe-frontend.service.d/verify-build.conf
+cp "${REPO_DIR}/ops/systemd/bbe-site-healthcheck.service" /etc/systemd/system/
+cp "${REPO_DIR}/ops/systemd/bbe-site-healthcheck.timer" /etc/systemd/system/
+
+systemctl daemon-reload
+systemctl restart bbe-frontend
+systemctl enable --now bbe-site-healthcheck.timer
+
+echo "install-systemd: OK"
+systemctl status bbe-frontend --no-pager -n 5 || true
+systemctl list-timers bbe-site-healthcheck --no-pager || true